CVE-2021-24827
Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection
Vexday Risk Score
23Low
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS —EPSS 13.3%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
08 Nov 2021Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue
Affected products
Unknown · Asgaros ForumWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →